From 143b39c1855f8a22f474f20354ee5ee5d2f4d266 Mon Sep 17 00:00:00 2001 From: Stephen Frost Date: Thu, 27 Nov 2014 01:06:36 -0500 Subject: Rename pg_rowsecurity -> pg_policy and other fixes As pointed out by Robert, we should really have named pg_rowsecurity pg_policy, as the objects stored in that catalog are policies. This patch fixes that and updates the column names to start with 'pol' to match the new catalog name. The security consideration for COPY with row level security, also pointed out by Robert, has also been addressed by remembering and re-checking the OID of the relation initially referenced during COPY processing, to make sure it hasn't changed under us by the time we finish planning out the query which has been built. Robert and Alvaro also commented on missing OCLASS and OBJECT entries for POLICY (formerly ROWSECURITY or POLICY, depending) in various places. This patch fixes that too, which also happens to add the ability to COMMENT on policies. In passing, attempt to improve the consistency of messages, comments, and documentation as well. This removes various incarnations of 'row-security', 'row-level security', 'Row-security', etc, in favor of 'policy', 'row level security' or 'row_security' as appropriate. Happy Thanksgiving! --- doc/src/sgml/catalogs.sgml | 44 ++++++++++++++++----------------- doc/src/sgml/ddl.sgml | 4 +-- doc/src/sgml/ref/alter_policy.sgml | 4 +-- doc/src/sgml/ref/create_policy.sgml | 49 ++++++++++++++++++------------------- doc/src/sgml/ref/drop_policy.sgml | 16 ++++++------ doc/src/sgml/rules.sgml | 2 +- 6 files changed, 59 insertions(+), 60 deletions(-) (limited to 'doc/src') diff --git a/doc/src/sgml/catalogs.sgml b/doc/src/sgml/catalogs.sgml index f98e282741f..9ceb96b54c7 100644 --- a/doc/src/sgml/catalogs.sgml +++ b/doc/src/sgml/catalogs.sgml @@ -239,8 +239,8 @@ - pg_rowsecurity - table row-level security policies + pg_policy + table policies @@ -1944,8 +1944,8 @@ bool - True if table has row-security enabled; see - pg_rowsecurity catalog + True if table has row level security enabled; see + pg_policy catalog @@ -5342,15 +5342,15 @@ - - <structname>pg_rowsecurity</structname> + + <structname>pg_policy</structname> - - pg_rowsecurity + + pg_policy - The catalog pg_rowsecurity stores row-level + The catalog pg_policy stores row-level security policies for each table. A policy includes the kind of command which it applies to (or all commands), the roles which it applies to, the expression to be added as a security-barrier @@ -5361,7 +5361,7 @@ - <structname>pg_rowsecurity</structname> Columns + <structname>pg_policy</structname> Columns @@ -5375,42 +5375,42 @@ - rsecpolname + polname name - The name of the row-security policy + The name of the policy - rsecrelid + polrelid oid pg_class.oid - The table to which the row-security policy belongs + The table to which the policy belongs - rseccmd + polcmd char - The command type to which the row-security policy is applied. + The command type to which the policy is applied. - rsecroles + polroles char - The roles to which the row-security policy is applied. + The roles to which the policy is applied. - rsecqual + polqual pg_node_tree The expression tree to be added to the security barrier qualifications for queries which use the table. - rsecwithcheck + polwithcheck pg_node_tree The expression tree to be added to the with check qualifications for queries which attempt to add rows to the table. @@ -5423,8 +5423,8 @@ pg_class.relrowsecurity - True if the table has row-security enabled. Policies will not be applied - unless row-security is enabled on the table. + True if the table has row security enabled. Policies will not be applied + unless row security is enabled on the table. diff --git a/doc/src/sgml/ddl.sgml b/doc/src/sgml/ddl.sgml index f9dc151a0cc..570a003e4a9 100644 --- a/doc/src/sgml/ddl.sgml +++ b/doc/src/sgml/ddl.sgml @@ -1558,8 +1558,8 @@ REVOKE ALL ON accounts FROM PUBLIC; To specify which rows are visible and what rows can be added to the - table with row security, an expression is required which returns a - boolean result. This expression will be evaluated for each row prior + table with row level security, an expression is required which returns + a boolean result. This expression will be evaluated for each row prior to other conditionals or functions which are part of the query. The one exception to this rule are leakproof functions, which are guaranteed to not leak information. Two expressions may be diff --git a/doc/src/sgml/ref/alter_policy.sgml b/doc/src/sgml/ref/alter_policy.sgml index ab717f31c51..796035e9da9 100644 --- a/doc/src/sgml/ref/alter_policy.sgml +++ b/doc/src/sgml/ref/alter_policy.sgml @@ -16,7 +16,7 @@ PostgreSQL documentation ALTER POLICY - change the definition of a row-security policy + change the definition of a policy @@ -34,7 +34,7 @@ ALTER POLICY name ON ALTER POLICY changes the - definition of an existing row-security policy. + definition of an existing policy. diff --git a/doc/src/sgml/ref/create_policy.sgml b/doc/src/sgml/ref/create_policy.sgml index eff062c114f..4c8c0019313 100644 --- a/doc/src/sgml/ref/create_policy.sgml +++ b/doc/src/sgml/ref/create_policy.sgml @@ -16,7 +16,7 @@ PostgreSQL documentation CREATE POLICY - define a new row-security policy for a table + define a new policy for a table @@ -33,14 +33,13 @@ CREATE POLICY name ON Description - The CREATE POLICY command defines a new row-security - policy for a table. Note that row-security must also be enabled on the - table using ALTER TABLE in order for created policies - to be applied. + The CREATE POLICY command defines a new policy for a + table. Note that row level security must also be enabled on the table using + ALTER TABLE in order for created policies to be applied. - A row-security policy is an expression which is added to the security-barrier + A policy is an expression which is added to the security-barrier qualifications of queries which are run against the table the policy is on, or an expression which is added to the with-check options for a table and which is applied to rows which would be added to the table. @@ -49,7 +48,7 @@ CREATE POLICY name ON @@ -66,22 +65,22 @@ CREATE POLICY name ON - Note that while row-security policies will be applied for explicit queries - against tables in the system, they are not applied when the system is - performing internal referential integrity checks or validating constraints. - This means there are indirect ways to determine that a given value exists. - An example of this is attempting to insert a duplicate value - into a column which is the primary key or has a unique constraint. If the - insert fails then the user can infer that the value already exists (this - example assumes that the user is permitted by policy to insert - records which they are not allowed to see). Another example is where a user - is allowed to insert into a table which references another, otherwise hidden - table. Existence can be determined by the user inserting values into the - referencing table, where success would indicate that the value exists in the - referenced table. These issues can be addressed by carefully crafting - policies which prevent users from being able to insert, delete, or update - records at all which might possibly indicate a value they are not otherwise - able to see, or by using generated values (e.g.: surrogate keys) instead. + Note that while policies will be applied for explicit queries against tables + in the system, they are not applied when the system is performing internal + referential integrity checks or validating constraints. This means there are + indirect ways to determine that a given value exists. An example of this is + attempting to insert a duplicate value into a column which is the primary key + or has a unique constraint. If the insert fails then the user can infer that + the value already exists (this example assumes that the user is permitted by + policy to insert records which they are not allowed to see). Another example + is where a user is allowed to insert into a table which references another, + otherwise hidden table. Existence can be determined by the user inserting + values into the referencing table, where success would indicate that the + value exists in the referenced table. These issues can be addressed by + carefully crafting policies which prevent users from being able to insert, + delete, or update records at all which might possibly indicate a value they + are not otherwise able to see, or by using generated values (e.g.: surrogate + keys) instead. @@ -291,8 +290,8 @@ CREATE POLICY name ON In order to maintain referential integrity between - two related tables, row-security policies are not applied when the system - performs checks on foreign key constraints. + two related tables, policies are not applied when the system performs + checks on foreign key constraints. diff --git a/doc/src/sgml/ref/drop_policy.sgml b/doc/src/sgml/ref/drop_policy.sgml index 31ca9db220e..bd4ef5cf7ce 100644 --- a/doc/src/sgml/ref/drop_policy.sgml +++ b/doc/src/sgml/ref/drop_policy.sgml @@ -16,7 +16,7 @@ PostgreSQL documentation DROP POLICY - remove a row-security policy from a table + remove a policy from a table @@ -29,11 +29,11 @@ DROP POLICY [ IF EXISTS ] name ON < Description - DROP POLICY removes the specified row-security policy - from the table. Note that if the last policy is removed for a table and - the table still has ROW POLICY enabled via ALTER TABLE, - then the default-deny policy will be used. ALTER TABLE - can be used to disable row security for a table using + DROP POLICY removes the specified policy from the table. + Note that if the last policy is removed for a table and the table still has + row level security enabled via ALTER TABLE, then the + default-deny policy will be used. ALTER TABLE can be used + to disable row level security for a table using DISABLE ROW SECURITY, whether policies for the table exist or not. @@ -80,8 +80,8 @@ DROP POLICY [ IF EXISTS ] name ON < Examples - To drop the row-security policy called p1 on the - table named my_table: + To drop the policy called p1 on the table named + my_table: DROP POLICY p1 ON my_table; diff --git a/doc/src/sgml/rules.sgml b/doc/src/sgml/rules.sgml index 66b3cc9bf2f..973db7435bc 100644 --- a/doc/src/sgml/rules.sgml +++ b/doc/src/sgml/rules.sgml @@ -2133,7 +2133,7 @@ SELECT * FROM phone_number WHERE tricky(person, phone); - When it is necessary for a view to provide row-level security, the + When it is necessary for a view to provide row level security, the security_barrier attribute should be applied to the view. This prevents maliciously-chosen functions and operators from being invoked on rows until after the view has done its work. For -- cgit v1.2.3